- Linux-stable-mirror - lists.linaro.org

[PATCH 4.4] drm/qxl: qxl_release leak in qxl_draw_dirty_fb()

by Vasily Averin

>From 85e9b88af1e6164f19ec71381efd5e2bcfc17620 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Mon, 27 Apr 2020 08:32:46 +0300 Subject: [PATCH] drm/qxl: qxl_release leak in qxl_draw_dirty_fb() ret should be changed to release allocated struct qxl_release Cc: stable(a)vger.kernel.org Fixes: 8002db6336dd ("qxl: convert qxl driver to proper use for reservations") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/22cfd55f-07c8-95d0-a2f7-191b71… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> backported to v4.4-stable Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> --- drivers/gpu/drm/qxl/qxl_draw.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index 6e6c76080d6a..c8ccb3765597 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -352,9 +352,10 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, goto out_release_backoff; rects = drawable_set_clipping(qdev, drawable, num_clips, clips_bo); - if (!rects) + if (!rects) { + ret = -EINVAL; goto out_release_backoff; - + } drawable = (struct qxl_drawable *)qxl_release_map(qdev, release); drawable->clip.type = SPICE_CLIP_TYPE_RECTS; -- 2.17.1

5 years, 7 months

1
0
0 0

[PATCH 4.4] drm/qxl: qxl_release use after free

by Vasily Averin

>From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> backported to v4.4-stable Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> --- drivers/gpu/drm/qxl/qxl_cmd.c | 5 ++--- drivers/gpu/drm/qxl/qxl_display.c | 6 +++--- drivers/gpu/drm/qxl/qxl_draw.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +---- 4 files changed, 10 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index fdc1833b1af8..45e08a685102 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -528,8 +528,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -571,9 +571,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index 5edebf495c07..0d6cc396cc16 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -292,8 +292,8 @@ qxl_hide_cursor(struct qxl_device *qdev) cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return 0; } @@ -390,8 +390,8 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc, cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); /* finish with the userspace bo */ ret = qxl_bo_reserve(user_bo, false); @@ -450,8 +450,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc, cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index c8ccb3765597..47da124b7ebf 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -245,8 +245,8 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image, qxl_bo_physical_address(qdev, dimage->bo, 0); qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_palette: if (palette_bo) @@ -386,8 +386,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) @@ -437,8 +437,8 @@ void qxl_draw_copyarea(struct qxl_device *qdev, drawable->u.copy_bits.src_pos.y = sy; qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_release: if (ret) @@ -481,8 +481,8 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec) qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_release: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 7c2e78201ead..4d852449a7d1 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -257,11 +257,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release: -- 2.17.1

5 years, 7 months

1
0
0 0

[PATCH 4.9] drm/qxl: qxl_release use after free

by Vasily Averin

>From 933db73351d359f74b14f4af095808260aff11f9 Mon Sep 17 00:00:00 2001 From: Vasily Averin <vvs(a)virtuozzo.com> Date: Wed, 29 Apr 2020 12:01:24 +0300 Subject: [PATCH] drm/qxl: qxl_release use after free qxl_release should not be accesses after qxl_push_*_ring_release() calls: userspace driver can process submitted command quickly, move qxl_release into release_ring, generate interrupt and trigger garbage collector. It can lead to crashes in qxl driver or trigger memory corruption in some kmalloc-192 slab object Gerd Hoffmann proposes to swap the qxl_release_fence_buffer_objects() + qxl_push_{cursor,command}_ring_release() calls to close that race window. cc: stable(a)vger.kernel.org Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> Link: http://patchwork.freedesktop.org/patch/msgid/fa17b338-66ae-f299-68fe-8d3241… Signed-off-by: Gerd Hoffmann <kraxel(a)redhat.com> backported to v4.9-stable Signed-off-by: Vasily Averin <vvs(a)virtuozzo.com> --- drivers/gpu/drm/qxl/qxl_cmd.c | 5 ++--- drivers/gpu/drm/qxl/qxl_display.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_draw.c | 8 ++++---- drivers/gpu/drm/qxl/qxl_ioctl.c | 5 +---- 4 files changed, 11 insertions(+), 15 deletions(-) diff --git a/drivers/gpu/drm/qxl/qxl_cmd.c b/drivers/gpu/drm/qxl/qxl_cmd.c index 04270f5d110c..91774756ae99 100644 --- a/drivers/gpu/drm/qxl/qxl_cmd.c +++ b/drivers/gpu/drm/qxl/qxl_cmd.c @@ -528,8 +528,8 @@ int qxl_hw_surface_alloc(struct qxl_device *qdev, /* no need to add a release to the fence for this surface bo, since it is only released when we ask to destroy the surface and it would never signal otherwise */ - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); surf->hw_surf_alloc = true; spin_lock(&qdev->surf_id_idr_lock); @@ -571,9 +571,8 @@ int qxl_hw_surface_dealloc(struct qxl_device *qdev, cmd->surface_id = id; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); - qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_SURFACE, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c index a61c0d460ec2..f8a1f84c8838 100644 --- a/drivers/gpu/drm/qxl/qxl_display.c +++ b/drivers/gpu/drm/qxl/qxl_display.c @@ -292,8 +292,8 @@ qxl_hide_cursor(struct qxl_device *qdev) cmd->type = QXL_CURSOR_HIDE; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return 0; } @@ -333,8 +333,8 @@ static int qxl_crtc_apply_cursor(struct drm_crtc *crtc) cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return ret; @@ -436,8 +436,8 @@ static int qxl_crtc_cursor_set2(struct drm_crtc *crtc, cmd->u.set.visible = 1; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); /* finish with the userspace bo */ ret = qxl_bo_reserve(user_bo, false); @@ -497,8 +497,8 @@ static int qxl_crtc_cursor_move(struct drm_crtc *crtc, cmd->u.position.y = qcrtc->cur_y + qcrtc->hot_spot_y; qxl_release_unmap(qdev, release, &cmd->release_info); - qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); qxl_release_fence_buffer_objects(release); + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); return 0; } diff --git a/drivers/gpu/drm/qxl/qxl_draw.c b/drivers/gpu/drm/qxl/qxl_draw.c index 9b728edf1b49..f32b663e5bbc 100644 --- a/drivers/gpu/drm/qxl/qxl_draw.c +++ b/drivers/gpu/drm/qxl/qxl_draw.c @@ -241,8 +241,8 @@ void qxl_draw_opaque_fb(const struct qxl_fb_image *qxl_fb_image, qxl_bo_physical_address(qdev, dimage->bo, 0); qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_palette: if (palette_bo) @@ -381,8 +381,8 @@ void qxl_draw_dirty_fb(struct qxl_device *qdev, } qxl_bo_kunmap(clips_bo); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_release_backoff: if (ret) @@ -432,8 +432,8 @@ void qxl_draw_copyarea(struct qxl_device *qdev, drawable->u.copy_bits.src_pos.y = sy; qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_release: if (ret) @@ -476,8 +476,8 @@ void qxl_draw_fill(struct qxl_draw_fill *qxl_draw_fill_rec) qxl_release_unmap(qdev, release, &drawable->release_info); - qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); qxl_release_fence_buffer_objects(release); + qxl_push_command_ring_release(qdev, release, QXL_CMD_DRAW, false); out_free_release: if (ret) diff --git a/drivers/gpu/drm/qxl/qxl_ioctl.c b/drivers/gpu/drm/qxl/qxl_ioctl.c index 5a4c8c492683..db0afb0613c9 100644 --- a/drivers/gpu/drm/qxl/qxl_ioctl.c +++ b/drivers/gpu/drm/qxl/qxl_ioctl.c @@ -256,11 +256,8 @@ static int qxl_process_single_command(struct qxl_device *qdev, apply_surf_reloc(qdev, &reloc_info[i]); } + qxl_release_fence_buffer_objects(release); ret = qxl_push_command_ring_release(qdev, release, cmd->type, true); - if (ret) - qxl_release_backoff_reserve_list(release); - else - qxl_release_fence_buffer_objects(release); out_free_bos: out_free_release: -- 2.17.1

5 years, 7 months

1
0
0 0

Re: stable-rc/linux-5.4.y bisection: baseline.dmesg.alert on meson-g12a-x96-max

by Guillaume Tucker

Please see the bisection report below about a kernel Oops. Reports aren't automatically sent to the public while we're trialing new bisection features on kernelci.org but this one looks valid. The log shows a kernel NULL pointer dereference: https://storage.kernelci.org/stable-rc/linux-5.4.y/v5.4.36-52-g35bbc55d9e29… The call stack is not the same as in the commit message found by the bisection, so maybe it only fixed part of the problem: <1>[ 16.007376] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 <1>[ 16.016300] Mem abort info: <1>[ 16.019269] ESR = 0x96000006 <1>[ 16.022571] EC = 0x25: DABT (current EL), IL = 32 bits <1>[ 16.028075] SET = 0, FnV = 0 <1>[ 16.031356] EA = 0, S1PTW = 0 <1>[ 16.034705] Data abort info: <1>[ 16.037837] ISV = 0, ISS = 0x00000006 <1>[ 16.041876] CM = 0, WnR = 0 <1>[ 16.045128] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000be0f0000 <1>[ 16.051702] [0000000000000010] pgd=00000000be117003, pud=00000000be118003, pmd=0000000000000000 <0>[ 16.051709] Internal error: Oops: 96000006 [#1] PREEMPT SMP <4>[ 16.133466] CPU: 2 PID: 33 Comm: kworker/2:1 Tainted: G W 5.4.37-rc1 #1 <4>[ 16.141566] Hardware name: Shenzhen Amediatech Technology Co., Ltd X96 Max (DT) <4>[ 16.149087] Workqueue: events deferred_probe_work_func <4>[ 16.154419] pstate: 20000005 (nzCv daif -PAN -UAO) <4>[ 16.159428] pc : snd_soc_dapm_new_dai+0x3c/0x1b0 <4>[ 16.164252] lr : snd_soc_dapm_connect_dai_link_widgets+0x114/0x268 <4>[ 16.256970] Call trace: <4>[ 16.259647] snd_soc_dapm_new_dai+0x3c/0x1b0 <4>[ 16.264129] snd_soc_dapm_connect_dai_link_widgets+0x114/0x268 <4>[ 16.270167] snd_soc_instantiate_card+0x858/0xb88 <4>[ 16.275083] snd_soc_register_card+0xf8/0x120 <4>[ 16.279656] devm_snd_soc_register_card+0x40/0x90 <4>[ 16.284575] axg_card_probe+0x9dc/0xaf0 [snd_soc_meson_axg_sound_card] <4>[ 16.291299] platform_drv_probe+0x50/0xa0 <4>[ 16.295524] really_probe+0xd4/0x328 <4>[ 16.299319] driver_probe_device+0x54/0xe8 ... Guillaume On 01/05/2020 10:32, kernelci.org bot wrote: > * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * > * This automated bisection report was sent to you on the basis * > * that you may be involved with the breaking commit it has * > * found. No manual investigation has been done to verify it, * > * and the root cause of the problem may be somewhere else. * > * * > * If you do send a fix, please include this trailer: * > * Reported-by: "kernelci.org bot" <bot(a)kernelci.org> * > * * > * Hope this helps! * > * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * > > stable-rc/linux-5.4.y bisection: baseline.dmesg.alert on meson-g12a-x96-max > > Summary: > Start: 35bbc55d9e296 Linux 5.4.37-rc1 > Plain log: https://storage.kernelci.org/stable-rc/linux-5.4.y/v5.4.36-52-g35bbc55d9e29… > HTML log: https://storage.kernelci.org/stable-rc/linux-5.4.y/v5.4.36-52-g35bbc55d9e29… > Result: 09f4294793bd3 ASoC: meson: axg-card: fix codec-to-codec link setup > > Checks: > revert: PASS > verify: PASS > > Parameters: > Tree: stable-rc > URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git > Branch: linux-5.4.y > Target: meson-g12a-x96-max > CPU arch: arm64 > Lab: lab-baylibre > Compiler: gcc-8 > Config: defconfig > Test case: baseline.dmesg.alert > > Breaking commit found: > > ------------------------------------------------------------------------------- > commit 09f4294793bd3e70d68fdab5b392dff18bff62ca > Author: Jerome Brunet <jbrunet(a)baylibre.com> > Date: Mon Apr 20 13:45:10 2020 +0200 > > ASoC: meson: axg-card: fix codec-to-codec link setup > > commit 1164284270779e1865cc2046a2a01b58a1e858a9 upstream. > > Since the addition of commit 9b5db059366a ("ASoC: soc-pcm: dpcm: Only allow > playback/capture if supported"), meson-axg cards which have codec-to-codec > links fail to init and Oops: > > Unable to handle kernel NULL pointer dereference at virtual address 0000000000000128 > Internal error: Oops: 96000044 [#1] PREEMPT SMP > CPU: 3 PID: 1582 Comm: arecord Not tainted 5.7.0-rc1 > pc : invalidate_paths_ep+0x30/0xe0 > lr : snd_soc_dapm_dai_get_connected_widgets+0x170/0x1a8 > Call trace: > invalidate_paths_ep+0x30/0xe0 > snd_soc_dapm_dai_get_connected_widgets+0x170/0x1a8 > dpcm_path_get+0x38/0xd0 > dpcm_fe_dai_open+0x70/0x920 > snd_pcm_open_substream+0x564/0x840 > snd_pcm_open+0xfc/0x228 > snd_pcm_capture_open+0x4c/0x78 > snd_open+0xac/0x1a8 > ... > > While initiliazing the links, ASoC treats the codec-to-codec links of this > card type as a DPCM backend. This error eventually leads to the Oops. > > Most of the card driver code is shared between DPCM backends and > codec-to-codec links. The property "no_pcm" marking DCPM BE was left set on > codec-to-codec links, leading to this problem. This commit fixes that. > > Fixes: 0a8f1117a680 ("ASoC: meson: axg-card: add basic codec-to-codec link support") > Signed-off-by: Jerome Brunet <jbrunet(a)baylibre.com> > Link: https://lore.kernel.org/r/20200420114511.450560-2-jbrunet@baylibre.com > Signed-off-by: Mark Brown <broonie(a)kernel.org> > Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> > > diff --git a/sound/soc/meson/axg-card.c b/sound/soc/meson/axg-card.c > index 1f698adde506c..2b04ac3d8fd3b 100644 > --- a/sound/soc/meson/axg-card.c > +++ b/sound/soc/meson/axg-card.c > @@ -586,8 +586,10 @@ static int axg_card_add_link(struct snd_soc_card *card, struct device_node *np, > > if (axg_card_cpu_is_tdm_iface(dai_link->cpus->of_node)) > ret = axg_card_parse_tdm(card, np, index); > - else if (axg_card_cpu_is_codec(dai_link->cpus->of_node)) > + else if (axg_card_cpu_is_codec(dai_link->cpus->of_node)) { > dai_link->params = &codec_params; > + dai_link->no_pcm = 0; /* link is not a DPCM BE */ > + } > > return ret; > } > ------------------------------------------------------------------------------- > > > Git bisection log: > > ------------------------------------------------------------------------------- > git bisect start > # good: [aa73bcc376865c23e61dcebd467697b527901be8] Linux 5.4.36 > git bisect good aa73bcc376865c23e61dcebd467697b527901be8 > # bad: [35bbc55d9e296d37cf01555d415338b84a70d4c5] Linux 5.4.37-rc1 > git bisect bad 35bbc55d9e296d37cf01555d415338b84a70d4c5 > # bad: [924f1d37852ff357658c205dd114c70862865fc9] svcrdma: Fix trace point use-after-free race > git bisect bad 924f1d37852ff357658c205dd114c70862865fc9 > # good: [b848f65436665b5fe675fd3f645c1a458e49f60a] counter: 104-quad-8: Add lock guards - generic interface > git bisect good b848f65436665b5fe675fd3f645c1a458e49f60a > # bad: [04b53ed855129c1703d00d8494e4c61309714a99] drivers: soc: xilinx: fix firmware driver Kconfig dependency > git bisect bad 04b53ed855129c1703d00d8494e4c61309714a99 > # good: [ae886eae0318c71a6125347d6810a1578a83d262] ASoC: tas571x: disable regulators on failed probe > git bisect good ae886eae0318c71a6125347d6810a1578a83d262 > # bad: [2c0990070379284dda0b51304ce19c2b96e083a2] ASoC: wm8960: Fix wrong clock after suspend & resume > git bisect bad 2c0990070379284dda0b51304ce19c2b96e083a2 > # bad: [09f4294793bd3e70d68fdab5b392dff18bff62ca] ASoC: meson: axg-card: fix codec-to-codec link setup > git bisect bad 09f4294793bd3e70d68fdab5b392dff18bff62ca > # first bad commit: [09f4294793bd3e70d68fdab5b392dff18bff62ca] ASoC: meson: axg-card: fix codec-to-codec link setup > ------------------------------------------------------------------------------- >

5 years, 7 months

5
5
0 0

FAILED: patch "[PATCH] RDMA/core: Fix race between destroy and release FD object" failed to apply to 4.14-stable tree

by gregkh＠linuxfoundation.org

The patch below does not apply to the 4.14-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <stable(a)vger.kernel.org>. thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From f0abc761bbb9418876cc4d1ebc473e4ea6352e42 Mon Sep 17 00:00:00 2001 From: Leon Romanovsky <leon(a)kernel.org> Date: Thu, 23 Apr 2020 09:01:22 +0300 Subject: [PATCH] RDMA/core: Fix race between destroy and release FD object The call to ->lookup_put() was too early and it caused an unlock of the read/write protection of the uobject after the FD was put. This allows a race: CPU1 CPU2 rdma_lookup_put_uobject() lookup_put_fd_uobject() fput() fput() uverbs_uobject_fd_release() WARN_ON(uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE)); atomic_dec(usecnt) Fix the code by changing the order, first unlock and call to ->lookup_put() after that. Fixes: 3832125624b7 ("IB/core: Add support for idr types") Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@kernel.org Suggested-by: Jason Gunthorpe <jgg(a)mellanox.com> Signed-off-by: Leon Romanovsky <leonro(a)mellanox.com> Signed-off-by: Jason Gunthorpe <jgg(a)mellanox.com> diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c index 2947f4f83561..177333d8bcda 100644 --- a/drivers/infiniband/core/rdma_core.c +++ b/drivers/infiniband/core/rdma_core.c @@ -678,7 +678,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj, enum rdma_lookup_mode mode) { assert_uverbs_usecnt(uobj, mode); - uobj->uapi_object->type_class->lookup_put(uobj, mode); /* * In order to unlock an object, either decrease its usecnt for * read access or zero it in case of exclusive access. See @@ -695,6 +694,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj, break; } + uobj->uapi_object->type_class->lookup_put(uobj, mode); /* Pairs with the kref obtained by type->lookup_get */ uverbs_uobject_put(uobj); }

5 years, 7 months

1
0
0 0

Linux 5.6.10

by Greg KH

I'm announcing the release of the 5.6.10 kernel. All users of the 5.6 kernel series must upgrade. The updated 5.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 +- sound/soc/meson/axg-card.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) Greg Kroah-Hartman (2): Revert "ASoC: meson: axg-card: fix codec-to-codec link setup" Linux 5.6.10

5 years, 7 months

1
1
0 0

Linux 5.4.38

by Greg KH

I'm announcing the release of the 5.4.38 kernel. All users of the 5.4 kernel series must upgrade. The updated 5.4.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 +- sound/soc/meson/axg-card.c | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) Greg Kroah-Hartman (2): Revert "ASoC: meson: axg-card: fix codec-to-codec link setup" Linux 5.4.38

5 years, 7 months

1
1
0 0

Linux 4.19.120

by Greg KH

I'm announcing the release of the 4.19.120 kernel. All users of the 4.19 kernel series must upgrade. The updated 4.19.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.19.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/bcm283x.dtsi | 1 arch/arm64/include/asm/sysreg.h | 4 arch/x86/kernel/cpu/mshyperv.c | 4 arch/x86/net/bpf_jit_comp.c | 18 + arch/x86/net/bpf_jit_comp32.c | 24 +- drivers/android/binder_alloc.c | 8 drivers/hwmon/jc42.c | 2 drivers/i2c/busses/i2c-altera.c | 9 drivers/iio/adc/ad7793.c | 2 drivers/mtd/chips/cfi_cmdset_0002.c | 6 drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 drivers/net/ethernet/freescale/fec.h | 7 drivers/net/ethernet/freescale/fec_main.c | 149 ++++++++++++--- drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 6 drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 +-- drivers/pci/quirks.c | 18 + drivers/remoteproc/remoteproc_core.c | 2 drivers/staging/gasket/apex_driver.c | 7 drivers/target/target_core_fabric_lib.c | 2 drivers/target/target_core_user.c | 1 drivers/usb/dwc3/gadget.c | 8 drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 drivers/xen/xenbus/xenbus_client.c | 9 fs/ext4/ialloc.c | 2 fs/ext4/inode.c | 2 fs/ext4/mballoc.c | 6 fs/ext4/super.c | 3 fs/nfsd/nfs4state.c | 2 fs/pnode.c | 9 fs/xfs/xfs_icache.c | 10 + fs/xfs/xfs_ioctl.c | 5 fs/xfs/xfs_reflink.c | 1 fs/xfs/xfs_trans_ail.c | 4 include/linux/qed/qed_chain.h | 24 +- include/linux/sunrpc/svc_rdma.h | 1 include/trace/events/rpcrdma.h | 50 +++-- include/uapi/linux/swab.h | 4 kernel/bpf/cpumap.c | 2 kernel/events/core.c | 13 + mm/shmem.c | 4 net/rxrpc/local_object.c | 9 net/rxrpc/output.c | 44 +--- net/sunrpc/svc_xprt.c | 3 net/sunrpc/svcsock.c | 4 net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 22 ++ net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 net/sunrpc/xprtrdma/svc_rdma_sendto.c | 29 +- net/sunrpc/xprtrdma/svc_rdma_transport.c | 5 sound/pci/hda/hda_intel.c | 17 + sound/soc/codecs/tas571x.c | 20 +- sound/soc/codecs/wm8960.c | 3 sound/soc/qcom/qdsp6/q6afe-dai.c | 16 + tools/objtool/check.c | 17 + tools/objtool/orc_dump.c | 44 ++-- 55 files changed, 470 insertions(+), 239 deletions(-) Al Viro (1): propagate_one(): mnt_set_mountpoint() needs mount_lock Bjorn Helgaas (1): PCI: Move Apex Edge TPU class quirk to fix BAR assignment Bodo Stroesser (2): scsi: target: fix PR IN / READ FULL STATUS for FC scsi: target: tcmu: reset_ring should reset TCMU_DEV_BIT_BROKEN Brian Foster (1): xfs: acquire superblock freeze protection on eofblocks scans Christian Borntraeger (1): include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Chuck Lever (2): svcrdma: Fix trace point use-after-free race svcrdma: Fix leak of svc_rdma_recv_ctxt objects Clement Leger (1): remoteproc: Fix wrong rvring index computation Darrick J. Wong (1): xfs: fix partially uninitialized structure in xfs_reflink_remap_extent David Howells (1): rxrpc: Fix DATA Tx to disable nofrag for UDP on AF_INET6 socket Eric Biggers (1): xfs: clear PF_MEMALLOC before exiting xfsaild thread Fangrui Song (1): arm64: Delete the space separator in __emit_inst Greg Kroah-Hartman (1): Linux 4.19.120 Hui Wang (1): ALSA: hda: call runtime_allow() for all hda controllers Ian Rogers (1): perf/core: fix parent pid/tid in task exit events Jason Gunthorpe (1): net/cxgb4: Check the return from t4_query_params properly Josh Poimboeuf (2): objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings objtool: Support Clang non-section symbols in ORC dump Juergen Gross (1): xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Kai-Heng Feng (1): PCI: Avoid ASMedia XHCI USB PME# from D0 defect Liu Jian (1): mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Luke Nelson (3): bpf, x86_32: Fix incorrect encoding in BPF_LDX zero-extension bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B bpf, x86_32: Fix clobbering of dst for BPF_JSET Martin Fuzzey (1): net: fec: set GPR bit on suspend by DT configuration. Nathan Chancellor (1): usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Nicolas Saenz Julienne (1): ARM: dts: bcm283x: Disable dsi0 node Niklas Schnelle (1): net/mlx5: Fix failing fw tracer allocation on s390 Olaf Hering (1): x86: hyperv: report value of misc_features Philipp Puschmann (1): ASoC: tas571x: disable regulators on failed probe Ritesh Harjani (1): ext4: check for non-zero journal inum in ext4_calculate_overhead Roy Spliet (1): ALSA: hda: Explicitly permit using autosuspend if runtime PM is supported Sascha Hauer (1): hwmon: (jc42) Fix name to have no illegal characters Shengjiu Wang (1): ASoC: wm8960: Fix wrong clock after suspend & resume Stephan Gerhold (1): ASoC: q6dsp6: q6afe-dai: add missing channels to MI2S DAIs Takashi Iwai (1): ALSA: hda: Keep the controller initialization even if no codecs found Theodore Ts'o (2): ext4: increase wait time needed before reuse of deleted inode numbers ext4: convert BUG_ON's to WARN_ON's in mballoc.c Thinh Nguyen (1): usb: dwc3: gadget: Do link recovery for SS and SSP Toke Høiland-Jørgensen (1): cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled Tyler Hicks (1): binder: take read mode of mmap_sem in binder_alloc_free_page() Vasily Averin (1): nfsd: memory corruption in nfsd4_lock() Wolfram Sang (1): i2c: altera: use proper variable to hold errno Yang Shi (1): mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path YueHaibing (1): iio:ad7797: Use correct attribute_group Yuval Basson (1): qed: Fix use after free in qed_chain_free yangerkun (1): ext4: use matching invalidatepage in ext4_writepage

5 years, 7 months

1
1
0 0

Linux 4.14.178

by Greg KH

I'm announcing the release of the 4.14.178 kernel. All users of the 4.14 kernel series must upgrade. The updated 4.14.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/boot/dts/bcm283x.dtsi | 1 arch/arm/mach-imx/Makefile | 2 arch/arm64/include/asm/sysreg.h | 4 arch/powerpc/kernel/setup_64.c | 2 arch/x86/kernel/cpu/mshyperv.c | 4 arch/x86/kvm/vmx.c | 2 arch/x86/net/bpf_jit_comp.c | 18 ++ drivers/android/binder_alloc.c | 8 - drivers/char/tpm/tpm_ibmvtpm.c | 136 +++++++++++----------- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/crypto/mxs-dcp.c | 4 drivers/gpu/drm/msm/msm_gem.c | 4 drivers/hwmon/jc42.c | 2 drivers/i2c/busses/i2c-altera.c | 9 - drivers/iio/adc/ad7793.c | 2 drivers/iio/adc/stm32-adc.c | 31 ++++- drivers/iio/adc/xilinx-xadc-core.c | 17 ++ drivers/mtd/chips/cfi_cmdset_0002.c | 6 drivers/net/dsa/b53/b53_regs.h | 4 drivers/net/ethernet/broadcom/genet/bcmgenet.c | 3 drivers/net/ethernet/chelsio/cxgb4/cxgb4_ptp.c | 27 ---- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 drivers/net/ethernet/chelsio/cxgb4/t4_regs.h | 3 drivers/net/ethernet/qlogic/qed/qed_dev.c | 38 ++---- drivers/net/macsec.c | 12 + drivers/net/macvlan.c | 2 drivers/net/team/team.c | 4 drivers/net/vrf.c | 6 drivers/net/wireless/intel/iwlwifi/pcie/tx-gen2.c | 3 drivers/pci/pcie/aspm.c | 18 +- drivers/pwm/pwm-bcm2835.c | 1 drivers/pwm/pwm-rcar.c | 10 + drivers/pwm/pwm-renesas-tpu.c | 9 - drivers/remoteproc/remoteproc_core.c | 2 drivers/s390/cio/device.c | 13 +- drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/scsi_transport_iscsi.c | 4 drivers/staging/comedi/comedi_fops.c | 4 drivers/staging/comedi/drivers/dt2815.c | 3 drivers/staging/vt6656/int.c | 3 drivers/staging/vt6656/key.c | 14 -- drivers/staging/vt6656/main_usb.c | 31 ++--- drivers/target/target_core_fabric_lib.c | 2 drivers/tty/hvc/hvc_console.c | 23 ++- drivers/tty/rocket.c | 25 ++-- drivers/tty/serial/sh-sci.c | 13 +- drivers/tty/vt/vt.c | 2 drivers/usb/class/cdc-acm.c | 36 +++++ drivers/usb/class/cdc-acm.h | 5 drivers/usb/core/hub.c | 14 ++ drivers/usb/core/message.c | 9 + drivers/usb/core/quirks.c | 4 drivers/usb/dwc3/gadget.c | 8 - drivers/usb/early/xhci-dbc.c | 8 - drivers/usb/early/xhci-dbc.h | 18 ++ drivers/usb/gadget/function/f_fs.c | 4 drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 drivers/usb/misc/sisusbvga/sisusb.c | 20 +-- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +- drivers/usb/storage/uas.c | 46 ++++++- drivers/usb/storage/unusual_devs.h | 7 + drivers/watchdog/watchdog_dev.c | 1 drivers/xen/xenbus/xenbus_client.c | 9 + fs/ceph/caps.c | 8 - fs/ceph/export.c | 5 fs/ext4/block_validity.c | 54 ++++++++ fs/ext4/ext4.h | 15 ++ fs/ext4/extents.c | 59 +++++---- fs/ext4/ialloc.c | 4 fs/ext4/inode.c | 55 ++++++-- fs/ext4/ioctl.c | 2 fs/ext4/mballoc.c | 6 fs/ext4/namei.c | 4 fs/ext4/resize.c | 5 fs/ext4/super.c | 22 +-- fs/ext4/xattr.c | 5 fs/namespace.c | 2 fs/nfsd/nfs4state.c | 2 fs/pnode.c | 9 - fs/proc/vmcore.c | 2 fs/xfs/xfs_inode.c | 85 ++++++------- fs/xfs/xfs_log.c | 14 ++ fs/xfs/xfs_reflink.c | 1 include/linux/kvm_host.h | 2 include/linux/overflow.h | 31 +++++ include/linux/qed/qed_chain.h | 24 ++- include/linux/vmalloc.h | 2 include/net/tcp.h | 2 include/uapi/linux/keyctl.h | 7 - include/uapi/linux/swab.h | 4 ipc/util.c | 2 kernel/audit.c | 3 kernel/events/core.c | 22 ++- kernel/gcov/fs.c | 2 mm/hugetlb.c | 14 +- mm/ksm.c | 12 + mm/shmem.c | 4 mm/slub.c | 3 mm/vmalloc.c | 16 ++ net/ipv4/ip_vti.c | 4 net/ipv4/raw.c | 4 net/ipv4/route.c | 3 net/ipv4/xfrm4_output.c | 2 net/ipv6/ipv6_sockglue.c | 13 -- net/ipv6/xfrm6_output.c | 2 net/netrom/nr_route.c | 1 net/x25/x25_dev.c | 4 security/keys/internal.h | 12 + security/keys/keyctl.c | 58 ++++++--- sound/pci/hda/hda_intel.c | 1 sound/pci/hda/patch_realtek.c | 3 sound/soc/intel/atom/sst-atom-controls.c | 2 sound/soc/soc-dapm.c | 20 ++- sound/usb/format.c | 52 ++++++++ sound/usb/mixer_quirks.c | 12 + sound/usb/usx2y/usbusx2yaudio.c | 2 tools/objtool/check.c | 17 ++ tools/objtool/orc_dump.c | 44 ++++--- tools/testing/selftests/kmod/kmod.sh | 13 +- tools/vm/Makefile | 2 121 files changed, 1046 insertions(+), 484 deletions(-) Ahmad Fatoum (1): ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y Al Viro (1): propagate_one(): mnt_set_mountpoint() needs mount_lock Alan Stern (3): USB: core: Fix free-while-in-use bug in the USB S-Glibrary USB: hub: Fix handling of connect changes during sleep usb-storage: Add unusual_devs entry for JMicron JMS566 Alexander Tsoy (1): ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Andrew Melnychenko (1): tty: hvc: fix buffer overflow during hvc_alloc(). Arnd Bergmann (1): net: ipv4: avoid unused variable warning for sysctl Bodo Stroesser (1): scsi: target: fix PR IN / READ FULL STATUS for FC Changming Liu (1): USB: sisusbvga: Change port variable from signed to unsigned Chris Packham (1): powerpc/setup_64: Set cache-line-size based on cache-block-size Christian Borntraeger (1): include/uapi/linux/swab.h: fix userspace breakage, use __BITS_PER_LONG for swap Clement Leger (1): remoteproc: Fix wrong rvring index computation Colin Ian King (1): ext4: unsigned int compared against zero Cornelia Huck (1): s390/cio: avoid duplicated 'ADD' uevents Darrick J. Wong (2): xfs: validate sb_logsunit is a multiple of the fs blocksize xfs: fix partially uninitialized structure in xfs_reflink_remap_extent David Ahern (2): xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish vrf: Check skb for XFRM_TRANSFORMED flag David Howells (1): keys: Fix the use of the C++ keyword "private" in uapi/linux/keyctl.h Dmitry Monakhov (1): ext4: fix extent_status fragmentation for plain files Doug Berger (1): net: bcmgenet: correct per TX/RX ring statistics Eric Biggers (1): selftests: kmod: fix handling test numbers above 9 Eric Dumazet (1): tcp: cache line align MAX_TCP_HEADER Fangrui Song (1): arm64: Delete the space separator in __emit_inst Florian Fainelli (2): pwm: bcm2835: Dynamically allocate base net: dsa: b53: Fix ARL register definitions Geert Uytterhoeven (2): pwm: rcar: Fix late Runtime PM enablement pwm: renesas-tpu: Fix late Runtime PM enablement George Wilson (1): tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send() Greg Kroah-Hartman (1): Linux 4.14.178 Gyeongtaek Lee (1): ASoC: dapm: fixup dapm kcontrol widget Hans de Goede (1): ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() Heiner Kallweit (1): PCI/ASPM: Allow re-enabling Clock PM Ian Abbott (1): staging: comedi: dt2815: fix writing hi byte of analog output Ian Rogers (1): perf/core: fix parent pid/tid in task exit events James Smart (1): scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Jann Horn (2): USB: early: Handle AMD's spec-compliant identifiers, too vmalloc: fix remap_vmalloc_range() bounds checks Jarkko Sakkinen (1): tpm/tpm_tis: Free IRQ if probing fails Jason Gunthorpe (2): overflow.h: Add arithmetic shift helper net/cxgb4: Check the return from t4_query_params properly Jeremy Sowden (1): vti4: removed duplicate log message. Jiri Olsa (1): perf/core: Disable page faults when getting phys address Jiri Slaby (1): tty: rocket, avoid OOB access Johannes Berg (1): iwlwifi: pcie: actually release queue memory in TVQM John Haxby (1): ipv6: fix restrict IPV6_ADDRFORM operation Jonathan Cox (1): USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE Josh Poimboeuf (2): objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings objtool: Support Clang non-section symbols in ORC dump Juergen Gross (1): xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Kailang Yang (1): ALSA: hda/realtek - Add new codec supported for ALC245 Kazuhiro Fujita (1): serial: sh-sci: Make sure status register SCxSR is read in correct sequence Lars-Peter Clausen (3): iio: xilinx-xadc: Fix ADC-B powerdown iio: xilinx-xadc: Fix clearing interrupt when enabling trigger iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Liu Jian (1): mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Longpeng (1): mm/hugetlb: fix a addressing exception caused by huge_pte_offset Lucas Stach (1): tools/vm: fix cross-compile build Luke Nelson (1): bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Malcolm Priestley (5): staging: vt6656: Don't set RCR_MULTICAST or RCR_BROADCAST by default. staging: vt6656: Fix calling conditions of vnt_set_bss_mode staging: vt6656: Fix drivers TBTT timing counter. staging: vt6656: Fix pairwise key entry save. staging: vt6656: Power save stop wake_up_count wrap around. Muchun Song (1): mm/ksm: fix NULL pointer dereference when KSM zero page is enabled Nathan Chancellor (1): usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Nicolai Stange (1): net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() Nicolas Pitre (1): vt: don't hardcode the mem allocation upper bound Nicolas Saenz Julienne (1): ARM: dts: bcm283x: Disable dsi0 node Olaf Hering (1): x86: hyperv: report value of misc_features Oliver Neukum (4): cdc-acm: close race betrween suspend() and acm_softint cdc-acm: introduce a cool down UAS: no use logging any details in case of ENODEV UAS: fix deadlock in error handling and PM flushing work Olivier Moysan (1): iio: adc: stm32-adc: fix sleep in atomic context Paul Moore (1): audit: check the length of userspace generated audit records Piotr Krysiuk (1): fs/namespace.c: fix mountpoint reference counter race Qiujun Huang (1): ceph: return ceph_mdsc_do_request() errors from __get_parent() Rahul Lakkireddy (1): cxgb4: fix large delays in PTP synchronization Ritesh Harjani (1): ext4: check for non-zero journal inum in ext4_calculate_overhead Rob Clark (1): drm/msm: Use the correct dma_sync calls harder Sascha Hauer (1): hwmon: (jc42) Fix name to have no illegal characters Sean Christopherson (1): KVM: Check validity of resolved slot when searching memslots Taehee Yoo (3): macsec: avoid to set wrong mtu macvlan: fix null dereference in macvlan_device_event() team: fix hang in team_mode_get() Takashi Iwai (2): ALSA: hda: Remove ASUS ROG Zenith from the blacklist ALSA: usx2y: Fix potential NULL dereference Tero Kristo (1): watchdog: reset last_hw_keepalive time at start Theodore Ts'o (6): ext4: increase wait time needed before reuse of deleted inode numbers ext4: convert BUG_ON's to WARN_ON's in mballoc.c ext4: avoid declaring fs inconsistent due to invalid file handles ext4: protect journal inode's blocks using block_validity ext4: don't perform block validity checks on the journal inode ext4: fix block validity checks for journal inodes using indirect blocks Thinh Nguyen (1): usb: dwc3: gadget: Do link recovery for SS and SSP Tyler Hicks (1): binder: take read mode of mmap_sem in binder_alloc_free_page() Udipto Goswami (1): usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Uros Bizjak (1): KVM: VMX: Enable machine check support for 32bit targets Vasily Averin (3): kernel/gcov/fs.c: gcov_seq_next() should increase position index ipc/util.c: sysvipc_find_ipc() should increase position index nfsd: memory corruption in nfsd4_lock() Vlastimil Babka (1): mm, slub: restore the original intention of prefetch_freepointer() Waiman Long (1): KEYS: Avoid false positive ENOMEM error on key read Wei Yongjun (1): crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static Wolfram Sang (1): i2c: altera: use proper variable to hold errno Wu Bo (1): scsi: iscsi: Report unbind session event when the target has been removed Xiyu Yang (4): net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node net/x25: Fix x25_neigh refcnt leak when receiving frame ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif staging: comedi: Fix comedi_device refcnt leak in comedi_open Yan, Zheng (1): ceph: don't skip updating wanted caps when cap is stale Yang Shi (1): mm: shmem: disable interrupt when acquiring info->lock in userfaultfd_copy path YueHaibing (1): iio:ad7797: Use correct attribute_group Yuval Basson (1): qed: Fix use after free in qed_chain_free kaixuxia (1): xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT yangerkun (1): ext4: use matching invalidatepage in ext4_writepage

5 years, 7 months

1
1
0 0

Linux 4.9.221

by Greg KH

I'm announcing the release of the 4.9.221 kernel. All users of the 4.9 kernel series must upgrade. The updated 4.9.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.9.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/arm/mach-imx/Makefile | 2 arch/x86/kvm/vmx.c | 2 arch/x86/net/bpf_jit_comp.c | 18 +++++++- drivers/char/tpm/tpm_tis_core.c | 8 +++ drivers/crypto/mxs-dcp.c | 4 - drivers/gpu/drm/msm/msm_gem.c | 4 - drivers/hwmon/jc42.c | 2 drivers/iio/adc/xilinx-xadc-core.c | 17 ++++++-- drivers/mtd/chips/cfi_cmdset_0002.c | 6 ++ drivers/net/dsa/b53/b53_regs.h | 4 - drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 2 drivers/net/macsec.c | 12 +++-- drivers/net/macvlan.c | 2 drivers/net/team/team.c | 4 + drivers/pci/pcie/aspm.c | 18 +++++--- drivers/pwm/pwm-bcm2835.c | 1 drivers/pwm/pwm-rcar.c | 10 +++- drivers/pwm/pwm-renesas-tpu.c | 9 +--- drivers/remoteproc/remoteproc_core.c | 2 drivers/s390/cio/device.c | 13 ++++-- drivers/scsi/lpfc/lpfc_sli.c | 2 drivers/scsi/scsi_transport_iscsi.c | 4 + drivers/staging/comedi/comedi_fops.c | 4 + drivers/staging/comedi/drivers/dt2815.c | 3 + drivers/staging/vt6656/int.c | 3 - drivers/staging/vt6656/main_usb.c | 9 ++-- drivers/target/target_core_fabric_lib.c | 2 drivers/tty/hvc/hvc_console.c | 23 ++++++----- drivers/tty/rocket.c | 25 ++++++------ drivers/usb/core/hub.c | 14 ++++++ drivers/usb/core/message.c | 9 +++- drivers/usb/core/quirks.c | 4 + drivers/usb/gadget/function/f_fs.c | 4 + drivers/usb/gadget/udc/bdc/bdc_ep.c | 2 drivers/usb/misc/sisusbvga/sisusb.c | 20 ++++----- drivers/usb/misc/sisusbvga/sisusb_init.h | 14 +++--- drivers/usb/storage/uas.c | 46 +++++++++++++++++++++- drivers/usb/storage/unusual_devs.h | 7 +++ drivers/watchdog/watchdog_dev.c | 1 drivers/xen/xenbus/xenbus_client.c | 9 +++- fs/ceph/caps.c | 8 ++- fs/ceph/export.c | 5 ++ fs/ext4/block_validity.c | 54 ++++++++++++++++++++++++++ fs/ext4/ext4.h | 15 ++++++- fs/ext4/extents.c | 59 +++++++++++++++++------------ fs/ext4/ialloc.c | 2 fs/ext4/inode.c | 48 +++++++++++++++++------ fs/ext4/ioctl.c | 2 fs/ext4/mballoc.c | 6 +- fs/ext4/namei.c | 4 - fs/ext4/resize.c | 5 +- fs/ext4/super.c | 22 +++------- fs/fuse/dev.c | 12 ++++- fs/namespace.c | 2 fs/nfsd/nfs4state.c | 2 fs/pnode.c | 9 +--- fs/proc/vmcore.c | 2 fs/xfs/xfs_reflink.c | 1 include/linux/kvm_host.h | 2 include/linux/overflow.h | 31 +++++++++++++++ include/linux/vmalloc.h | 2 include/net/tcp.h | 2 ipc/util.c | 2 kernel/audit.c | 3 + kernel/events/core.c | 13 ++++-- kernel/gcov/fs.c | 2 mm/vmalloc.c | 16 ++++++- net/ipv4/ip_vti.c | 4 - net/ipv4/raw.c | 4 + net/ipv4/route.c | 3 - net/ipv4/xfrm4_output.c | 2 net/ipv6/ipv6_sockglue.c | 13 ++---- net/ipv6/xfrm6_output.c | 2 net/netrom/nr_route.c | 1 net/x25/x25_dev.c | 4 + sound/pci/hda/hda_intel.c | 1 sound/soc/intel/atom/sst-atom-controls.c | 2 sound/soc/soc-dapm.c | 20 ++++++++- sound/usb/format.c | 52 +++++++++++++++++++++++++ sound/usb/mixer_quirks.c | 12 +++-- sound/usb/usx2y/usbusx2yaudio.c | 2 tools/objtool/check.c | 17 +++++++- tools/objtool/orc_dump.c | 44 +++++++++++++-------- 84 files changed, 638 insertions(+), 223 deletions(-) Ahmad Fatoum (1): ARM: imx: provide v7_cpu_resume() only on ARM_CPU_SUSPEND=y Al Viro (1): propagate_one(): mnt_set_mountpoint() needs mount_lock Alan Stern (3): USB: core: Fix free-while-in-use bug in the USB S-Glibrary USB: hub: Fix handling of connect changes during sleep usb-storage: Add unusual_devs entry for JMicron JMS566 Alexander Tsoy (1): ALSA: usb-audio: Filter out unsupported sample rates on Focusrite devices Andrew Melnychenko (1): tty: hvc: fix buffer overflow during hvc_alloc(). Arnd Bergmann (1): net: ipv4: avoid unused variable warning for sysctl Bodo Stroesser (1): scsi: target: fix PR IN / READ FULL STATUS for FC Changming Liu (1): USB: sisusbvga: Change port variable from signed to unsigned Clement Leger (1): remoteproc: Fix wrong rvring index computation Colin Ian King (1): ext4: unsigned int compared against zero Cornelia Huck (1): s390/cio: avoid duplicated 'ADD' uevents Darrick J. Wong (1): xfs: fix partially uninitialized structure in xfs_reflink_remap_extent David Ahern (1): xfrm: Always set XFRM_TRANSFORMED in xfrm{4,6}_output_finish Dmitry Monakhov (1): ext4: fix extent_status fragmentation for plain files Eric Dumazet (1): tcp: cache line align MAX_TCP_HEADER Florian Fainelli (2): pwm: bcm2835: Dynamically allocate base net: dsa: b53: Fix ARL register definitions Geert Uytterhoeven (2): pwm: rcar: Fix late Runtime PM enablement pwm: renesas-tpu: Fix late Runtime PM enablement Greg Kroah-Hartman (1): Linux 4.9.221 Gyeongtaek Lee (1): ASoC: dapm: fixup dapm kcontrol widget Hans de Goede (1): ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() Heiner Kallweit (1): PCI/ASPM: Allow re-enabling Clock PM Ian Abbott (1): staging: comedi: dt2815: fix writing hi byte of analog output Ian Rogers (1): perf/core: fix parent pid/tid in task exit events James Smart (1): scsi: lpfc: Fix kasan slab-out-of-bounds error in lpfc_unreg_login Jann Horn (1): vmalloc: fix remap_vmalloc_range() bounds checks Jarkko Sakkinen (1): tpm/tpm_tis: Free IRQ if probing fails Jason Gunthorpe (2): overflow.h: Add arithmetic shift helper net/cxgb4: Check the return from t4_query_params properly Jeremy Sowden (1): vti4: removed duplicate log message. Jiri Slaby (1): tty: rocket, avoid OOB access John Haxby (1): ipv6: fix restrict IPV6_ADDRFORM operation Jonathan Cox (1): USB: Add USB_QUIRK_DELAY_CTRL_MSG and USB_QUIRK_DELAY_INIT for Corsair K70 RGB RAPIDFIRE Josh Poimboeuf (2): objtool: Fix CONFIG_UBSAN_TRAP unreachable warnings objtool: Support Clang non-section symbols in ORC dump Juergen Gross (1): xen/xenbus: ensure xenbus_map_ring_valloc() returns proper grant status Lars-Peter Clausen (3): iio: xilinx-xadc: Fix ADC-B powerdown iio: xilinx-xadc: Fix clearing interrupt when enabling trigger iio: xilinx-xadc: Fix sequencer configuration for aux channels in simultaneous mode Liu Jian (1): mtd: cfi: fix deadloop in cfi_cmdset_0002.c do_write_buffer Luke Nelson (1): bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX BPF_B Malcolm Priestley (2): staging: vt6656: Fix drivers TBTT timing counter. staging: vt6656: Power save stop wake_up_count wrap around. Miklos Szeredi (1): fuse: fix possibly missed wake-up after abort Nathan Chancellor (1): usb: gadget: udc: bdc: Remove unnecessary NULL checks in bdc_req_complete Nicolai Stange (1): net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg() Oliver Neukum (2): UAS: no use logging any details in case of ENODEV UAS: fix deadlock in error handling and PM flushing work Paul Moore (1): audit: check the length of userspace generated audit records Piotr Krysiuk (1): fs/namespace.c: fix mountpoint reference counter race Qiujun Huang (1): ceph: return ceph_mdsc_do_request() errors from __get_parent() Ritesh Harjani (1): ext4: check for non-zero journal inum in ext4_calculate_overhead Rob Clark (1): drm/msm: Use the correct dma_sync calls harder Sascha Hauer (1): hwmon: (jc42) Fix name to have no illegal characters Sean Christopherson (1): KVM: Check validity of resolved slot when searching memslots Taehee Yoo (3): macsec: avoid to set wrong mtu macvlan: fix null dereference in macvlan_device_event() team: fix hang in team_mode_get() Takashi Iwai (2): ALSA: hda: Remove ASUS ROG Zenith from the blacklist ALSA: usx2y: Fix potential NULL dereference Tero Kristo (1): watchdog: reset last_hw_keepalive time at start Theodore Ts'o (5): ext4: convert BUG_ON's to WARN_ON's in mballoc.c ext4: avoid declaring fs inconsistent due to invalid file handles ext4: protect journal inode's blocks using block_validity ext4: don't perform block validity checks on the journal inode ext4: fix block validity checks for journal inodes using indirect blocks Udipto Goswami (1): usb: f_fs: Clear OS Extended descriptor counts to zero in ffs_data_reset() Uros Bizjak (1): KVM: VMX: Enable machine check support for 32bit targets Vasily Averin (3): kernel/gcov/fs.c: gcov_seq_next() should increase position index ipc/util.c: sysvipc_find_ipc() should increase position index nfsd: memory corruption in nfsd4_lock() Wei Yongjun (1): crypto: mxs-dcp - make symbols 'sha1_null_hash' and 'sha256_null_hash' static Wu Bo (1): scsi: iscsi: Report unbind session event when the target has been removed Xiyu Yang (4): net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node net/x25: Fix x25_neigh refcnt leak when receiving frame ALSA: usb-audio: Fix usb audio refcnt leak when getting spdif staging: comedi: Fix comedi_device refcnt leak in comedi_open Yan, Zheng (1): ceph: don't skip updating wanted caps when cap is stale

5 years, 7 months

1
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror